mcp-server-mcpindex 0.3.8 → 0.3.9

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `mcp-server-mcpindex` are recorded here.
 
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.9] - 2026-07-15
+
+### Changed
+
+- **Tool descriptions now have a single source of truth (`src/tools-meta.json`).** The stdio CLI (`src/index.mjs`) and the hosted remote endpoint both import the shared name/title/description for the 6 tools, so their copy can no longer drift. Description text is byte-identical to 0.3.8; this is an internal refactor with no change to the advertised tool copy. Bumped so the refactored source is releasable to npm.
+
 ## [0.3.8] - 2026-07-15
 
 ### Fixed

package/README.md

@@ -12,6 +12,16 @@ npm install -g mcp-server-mcpindex
 
 This is the **directory / advisory** client (recommend, search, trust). It does **not** install the in-path drift gate — that is `curl -fsSL https://mcpindex.ai/install.sh | sh`.
 
+### Or connect remotely (no install)
+
+Prefer not to install anything? mcpindex is also a **hosted remote MCP server**. Point any client that supports remote MCP (Claude connectors, Cursor, etc.) at:
+
+```
+https://mcpindex.ai/api/mcp
+```
+
+Streamable HTTP, no credentials. Same six tools as the npm package.
+
 ### Claude Code
 
 ```bash

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.2",
   "name": "mcp-server-mcpindex",
   "display_name": "mcpindex",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "description": "The MCP directory that vets servers, not just lists them: search by task, then get an advisory screen on a server before an agent calls its tools. Advisory, conformance monitored not enforced, not a safety verdict.",
   "long_description": "mcpindex is the MCP directory that vets servers, not just lists them. Search by task to find the right server (ranked picks with install commands and quality scores), then get an advisory screen on a specific tool or a whole server before your agent calls it: whether each tool does what it claims. check_tool_trust and assess_server return an advisory verdict (REVIEW / UNVERIFIED at v1), backed by conformance monitoring and a live drift ledger, and fail closed to human review. Zero-config: queries the public mcpindex.ai API, no credentials. Monitored, not enforced; not a safety verdict and not an in-path gate.",
   "author": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-server-mcpindex",
-  "version": "0.3.8",
+  "version": "0.3.9",
   "mcpName": "io.github.gautamgb/mcp-server-mcpindex",
   "description": "The MCP directory that vets servers, not just lists them. Search by task, then get an advisory screen on a server before your agent calls its tools: whether each tool does what it claims, backed by conformance monitoring and a public drift ledger. Advisory (REVIEW / UNVERIFIED), monitored not enforced, not a safety verdict. Drop-in for Claude Desktop, Claude Code, Cursor, Gemini CLI, Cline, Zed.",
   "keywords": [

package/src/index.mjs

@@ -19,6 +19,10 @@ const API_BASE = process.env.MCPINDEX_API_BASE || 'https://mcpindex.ai';
 // Single source of truth for the running version - read from package.json so the
 // User-Agent and the update-check can never drift from what npm actually shipped.
 const PKG_VERSION = createRequire(import.meta.url)('../package.json').version;
+// Single source of truth for tool name/description, shared with the hosted
+// remote endpoint (mcpindex-web/app/api/[transport]/route.ts) so copy can't drift.
+const TOOL_META = createRequire(import.meta.url)('./tools-meta.json');
+const TOOL_DESC = Object.fromEntries(TOOL_META.map((m) => [m.name, m.description]));
 
 const server = new Server(
   { name: 'mcp-server-mcpindex', version: PKG_VERSION },
@@ -32,7 +36,7 @@ const TOOLS = [
   {
     name: 'recommend_mcp_for_task',
     description:
-      'Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do.',
+      TOOL_DESC.recommend_mcp_for_task,
     inputSchema: {
       type: 'object',
       properties: {
@@ -48,7 +52,7 @@ const TOOLS = [
   {
     name: 'search_mcp_servers',
     description:
-      'Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server.',
+      TOOL_DESC.search_mcp_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -70,7 +74,7 @@ const TOOLS = [
   {
     name: 'get_install_command',
     description:
-      'Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config.',
+      TOOL_DESC.get_install_command,
     inputSchema: {
       type: 'object',
       properties: {
@@ -91,7 +95,7 @@ const TOOLS = [
   {
     name: 'compare_servers',
     description:
-      'Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars.',
+      TOOL_DESC.compare_servers,
     inputSchema: {
       type: 'object',
       properties: {
@@ -109,7 +113,7 @@ const TOOLS = [
   {
     name: 'check_tool_trust',
     description:
-      'Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as "human review required", never as ALLOW.',
+      TOOL_DESC.check_tool_trust,
     inputSchema: {
       type: 'object',
       properties: {
@@ -128,7 +132,7 @@ const TOOLS = [
   {
     name: 'assess_server',
     description:
-      'Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for "is THIS server worth integrating?" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed.',
+      TOOL_DESC.assess_server,
     inputSchema: {
       type: 'object',
       properties: {

package/src/tools-meta.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "recommend_mcp_for_task",
+    "title": "Recommend MCP servers for a task",
+    "description": "Recommend the best MCP servers for a natural-language task. Returns top 3 ranked picks with reasoning, install commands, and quality scores. Use this when the user asks for the right MCP server for a task they want to do."
+  },
+  {
+    "name": "search_mcp_servers",
+    "title": "Search MCP servers",
+    "description": "Keyword + semantic search across the full MCP server registry. Use when the user knows what tool category they want but not which server."
+  },
+  {
+    "name": "get_install_command",
+    "title": "Get install command",
+    "description": "Get the exact install command for a given MCP server and client. Returns a JSON block ready to paste into the client config."
+  },
+  {
+    "name": "compare_servers",
+    "title": "Compare MCP servers",
+    "description": "Side-by-side comparison of 2-5 MCP servers - quality scores, install paths, transport types, env vars."
+  },
+  {
+    "name": "check_tool_trust",
+    "title": "Check tool trust (advisory)",
+    "description": "Pre-invocation advisory screen for a specific tool on an MCP server. Returns an advisory verdict object (directive ALLOW | DENY | REVIEW | UNVERIFIED, dimensions, freshness). At v1 the public screen produces REVIEW or UNVERIFIED only - ALLOW/DENY are reserved. Not the in-path gate (mcpindex-gate). Agents SHOULD treat UNVERIFIED as \"human review required\", never as ALLOW."
+  },
+  {
+    "name": "assess_server",
+    "title": "Assess server trust (advisory)",
+    "description": "Aggregated pre-flight trust assessment across all tools on an MCP server. Same verdict shape as check_tool_trust. Use for \"is THIS server worth integrating?\" decisions. v1 advisory; conformance monitored not enforced; verdicts may be UNVERIFIED if not yet probed."
+  }
+]